603ddb8484ea071943df56fa39d31dbf74fa45a8d4aea9025b3f78bd4eab2e00

Sharing

Copy URL

Twitter E-mail

General

Target

603ddb8484ea071943df56fa39d31dbf74fa45a8d4aea9025b3f78bd4eab2e00
Size

329KB
MD5

6afd3b726ad97eb6e0918e8b62973cae
SHA1

b7db4dd23792486edb845990911612d03873069e
SHA256

603ddb8484ea071943df56fa39d31dbf74fa45a8d4aea9025b3f78bd4eab2e00
SHA512

e11ec86da091ed9a005737cb5229dadc0036b0f55028becb9c4b0e627aec5e64db123311d6aff7224bb5eb38357ef7ead9be760fa431086016edd38a1bc925cc
SSDEEP

6144:WaW6tBQZegB13wV4Eos3DksgKYHM1LZyNz7r2VZ30hKSktFTK8/kA:WaWKt24TM1NqV9CchsA

Score

N/A

Malware Config

Signatures

Files

603ddb8484ea071943df56fa39d31dbf74fa45a8d4aea9025b3f78bd4eab2e00
.exe windows x86

e49e00e044a2d4d74be496616d59c7a2

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

msvcrt

_wcsnicmp
wcschr
_wcsicmp
wcscpy
_wcsupr
wcslen
wcspbrk
memmove
wcstoul
_snwprintf
wcsrchr
??3@YAXPAX@Z
_itow
_ultow
wcscat
qsort
_wcslwr
wcsspn
towlower
_vsnwprintf
free
_initterm
malloc
_adjust_fdiv
__dllonexit
_onexit
_except_handler3
__CxxFrameHandler
??2@YAPAXI@Z
wcsstr
wcsncpy

msvcp60

?replace@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@IIIG@Z
?find@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEIGI@Z
??Y?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV01@G@Z

advapi32

RegCreateKeyExW
RegDeleteValueW
EqualSid
RegConnectRegistryW
RegDeleteKeyW
GetOldestEventLogRecord
RegSetValueExW
RegOpenKeyExW
RegEnumKeyExW
RegCloseKey
IsValidSid
ClearEventLogW
ReadEventLogW
OpenBackupEventLogA
OpenEventLogW
GetNumberOfEventLogRecords
CloseEventLog
BackupEventLogW
ConvertStringSidToSidW
LookupAccountSidW
GetLengthSid
RegQueryValueExW

kernel32

GetLocalTime
GetTimeZoneInformation
GetProcessHeap
HeapAlloc
HeapFree
GetWindowsDirectoryW
WideCharToMultiByte
DisableThreadLibraryCalls
IsBadReadPtr
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
GetTickCount
GetLocaleInfoW
IsBadStringPtrW
LocalAlloc
GlobalAlloc
GlobalLock
CloseHandle
GlobalFree
LoadLibraryA
lstrcpynW
GetSystemWindowsDirectoryW
FileTimeToSystemTime
lstrcatW
GetTimeFormatW
GetDateFormatW
GetCurrentThreadId
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
GetDriveTypeW
SetUnhandledExceptionFilter
CreateThread
FileTimeToLocalFileTime
LocalFileTimeToFileTime
SystemTimeToFileTime
GetUserDefaultLCID
GlobalUnlock
GetComputerNameW
GetCommandLineW
DeleteFileW
GetFileAttributesExW
WriteFile
GetFileSize
DeleteCriticalSection
InterlockedIncrement
MultiByteToWideChar
GetLastError
InterlockedDecrement
LocalFree
GetModuleHandleA
GetModuleHandleW
GetProcAddress
lstrcmpiW
lstrcmpW
LoadLibraryW
SetLastError
GetModuleFileNameW
OutputDebugStringA
LoadLibraryExW
FreeLibrary
FormatMessageW
ExpandEnvironmentStringsW
lstrcpyW
lstrlenW
CreateFileW

user32

EnableWindow
CloseClipboard
SetClipboardData
IsDlgButtonChecked
EmptyClipboard
OpenClipboard
ShowWindow
SetDlgItemTextW
SetFocus
ReleaseDC
GetDC
SetWindowPos
CheckRadioButton
PostMessageW
DestroyWindow
GetWindowLongW
CreateDialogParamW
DialogBoxParamW
EndDialog
GetClientRect
CharUpperBuffA
DispatchMessageW
TranslateMessage
IsDialogMessageW
GetMessageW
PostQuitMessage
GetWindow
IsCharAlphaW
GetWindowTextLengthW
SetDlgItemInt
GetDlgItemInt
LoadStringW
RegisterClassW
CreateWindowExW
DefWindowProcW
WinHelpW
FindWindowExW
EnumThreadWindows
IsWindowEnabled
SetWindowLongW
GetDlgItem
RegisterClipboardFormatW
wsprintfW
GetSystemMetrics
LoadCursorW
SetCursor
GetParent
GetDlgItemTextW
SendMessageW
LoadBitmapW
LoadImageW
LoadIconW
GetSysColor
MessageBoxW
SetForegroundWindow
DestroyIcon
GetWindowTextW
CheckDlgButton
SetWindowTextW
GetWindowRect
GetClassNameW

gdi32

CreateFontIndirectW
GetMapMode
SetMapMode
GetTextMetricsW
DeleteObject
GetObjectW

ole32

CoUninitialize
IIDFromString
CoInitialize
CreateStreamOnHGlobal
CoMarshalInterThreadInterfaceInStream
CoTaskMemAlloc
ReleaseStgMedium
CoCreateInstance
CoGetInterfaceAndReleaseStream

rpcrt4

CStdStubBuffer_DebugServerQueryInterface
CStdStubBuffer_Disconnect
CStdStubBuffer_Invoke
CStdStubBuffer_Connect
NdrDllGetClassObject
CStdStubBuffer_QueryInterface
IUnknown_Release_Proxy
IUnknown_AddRef_Proxy
IUnknown_QueryInterface_Proxy
NdrOleFree
NdrOleAllocate
NdrCStdStubBuffer_Release
CStdStubBuffer_AddRef
CStdStubBuffer_DebugServerRelease
CStdStubBuffer_IsIIDSupported
CStdStubBuffer_CountRefs

shlwapi

PathCombineW
wnsprintfW
PathRemoveBlanksW

shell32

ShellExecuteW
CommandLineToArgvW

ntdsapi

DsFreeSchemaGuidMapW
DsCrackNamesW
DsMapSchemaGuidsW
DsFreeNameResultW
DsBindW
DsUnBindW

version

GetFileVersionInfoSizeW
VerQueryValueW
GetFileVersionInfoW

activeds

ord9
ord20
ord15

mpr

WNetGetUniversalNameW

Sections

.text
Size: 16KB - Virtual size: 16KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 306KB - Virtual size: 308KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.CECB
Size: 512B - Virtual size: 72KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

e49e00e044a2d4d74be496616d59c7a2

Headers

File Characteristics

Imports

msvcrt

msvcp60

advapi32

kernel32

user32

gdi32

ole32

rpcrt4

shlwapi

shell32

ntdsapi

version

activeds

mpr

Sections

.text Size: 16KB - Virtual size: 16KB

.rdata Size: 306KB - Virtual size: 308KB

.data Size: 2KB - Virtual size: 4KB

.CECB Size: 512B - Virtual size: 72KB

.rsrc Size: 4KB - Virtual size: 3KB

.text
Size: 16KB - Virtual size: 16KB

.rdata
Size: 306KB - Virtual size: 308KB

.data
Size: 2KB - Virtual size: 4KB

.CECB
Size: 512B - Virtual size: 72KB

.rsrc
Size: 4KB - Virtual size: 3KB